Foreword
Competency Model — a map of the jobs, roles, and KSAs
(Knowledge, Skills, and Abilities) that an organization must
possess within its workforce in order to achieve project and
mission success. In other words, a competency model is
an expression of “What skills do we need?”
Over 83% of CIOs agree1 workforce performance is
the leading factor for an organization to be capable of
reaching its goals — more than the technology used, or the
processes followed. Sooner or later, most companies and
government agencies must face the challenge of creating
or updating a competency model. Jobs and roles change
with time — and in modern times this need is critical.
Trying to self-define a competency model using internal
resources and/or specialized consultants can be a
daunting, time consuming, and expensive undertaking for a
number of reasons:
1. Recognizing the skills and roles needed,
let alone what job must have them and at what level,
is inherently difficult. It requires a high degree of
subject matter expertise.
2. T
he definition process never seems to end.
It never seems to be clear when the competency
model is complete. Forcing an arbitrary “finish by”
completion date can leave a sense of discomfort that
not all skills and roles have yet been identified.
3. F
or those skills and roles that are identified, there
is often concern that something has been missed
or that they are inaccurate.
Nonetheless, many organizations still go down the
self-definition path because it is believed that the skills and
roles they need are unique to them. This turns out not to be
the case in most instances. Experience has shown that the
majority of companies and government agencies will share
similar needs with only a small percentage truly specialized
to them. This is true, regardless of the vertical market
the organization is in, or the horizontal disciplines they
must deploy.

For example, verticals such as health care, financial
services, and oil and gas will usually need very similar skills
even if the job titles vary. The same is true for horizontal
disciplines, such as cyber security, project management,
information technology, and business analysis.
The commonality of roles and skills is good news! More and
more, the industry is producing competency requirements
based on effective bodies of knowledge. These are known
as Industry-Standard Frameworks (ISFs). Designed to
include the specific needs of a company or government
agency, ISFs will provide more accurate and complete
competency specifications in a fraction of the time and at
a fraction of the cost. ISFs come with an additional benefit
— training providers and consultants are aligned with these
frameworks and can be easily found.
This white paper focuses on how ISFs can be leveraged
within an organization to yield maximum benefit. ISFs can
be fully adopted as a standard, or used simply as a guide
to accelerate in-house definition. The steps of a practical
methodology are provided. The primary focus is to foster
success by better aligning the workforce with overall
organization goals and project needs. Use of most ISFs for
non-commercial purposes is free.

Industry-Standard Framework Examples
There are numerous competency libraries
for various verticals — for example,
see Lexonis.com. Herein we will look at a few
examples for horizontal application, including
the NICE Cybersecurity Workforce Framework (NCWF) and
the Skills Framework for the Information Age (SFIA). Other
frameworks for areas such as business analysis and Agile
practice are emerging. We will briefly look at an example for
project management.

Optimizing IT Workforce Performance

White Paper

NICE Cybersecurity Workforce
Framework (NCWF)
The quote below is taken from the NICE (National Initiative
for Cybersecurity Education) website and nicely captures the
intent and design of their workforce framework. Developed
under the direction of Executive Order 13636, the currently
active version of NCWF was released in 2014. For the
purpose of this discussion, the reader should be aware
that some details might change when the new version is
released, but the core of NCWF will stay the same.
For more information, see NIST Special Publication
800-181 or visit csrc.nist.gov/nice/framework

”

= Similar Skills and Roles

LEARNING TREE INTERNATIONAL

NCWF provides a common language to
describe cybersecurity work regardless
of organizational structures or job titles…
grouped together into a superset list of
required tasks and KSAs.
This information provides organizations
a reference level of detail around
what types of education, training,
certifications and skills it takes to perform
cybersecurity jobs. NCWF is flexible
and organizations should use it as a
reference to fit their specific needs.

NCWF Layout and Organization
NCWF organizes cyber security work into specialty areas
and roles. Similar specialty areas and work roles are
grouped together and referred to as categories.
Each work role outlines the tasks and KSAs needed to
perform the role.

Tasks &
KSAs

Defined

Work Role
Specialties

Grouped

Seven
Categories

Competency Modeling Using Industry-Standard Frameworks

3

1-800-843-8733 • LearningTree.com

LEARNING TREE INTERNATIONAL

White Paper

The benefits of the work roles alone are easily identified.
Combined appropriately, they will indicate the positions you
need to staff, and the necessary training for each employee
to ensure they possess the KSAs needed to do their job.
A key aspect of NCWF is that it is not intended to be
prescriptive or limited, rather it is designed for maximum
flexibility. Each adopting organization will typically develop
their own cyber security profile(s) using NCWF as its core.

Training and Certifications
The enabling agency for NCWF is the National Initiative for
Cybersecurity Education (NICE), recognizing that identifying
the needed KSAs was only the starting point. Without
effective training, the goals of Executive Order 13636 could
not be achieved.
The diagram above highlights the seven NCWF categories.
Under these are 40 specialty areas. For example, a specialty
area under Protect and Defend is Computer Network
Defense Analysis.
This specialty outlines nineteen KSAs which vary across
a broad and diverse spectrum of work roles, such as:
• Computer Forensics

• Network Defense

• Criminal Law

•E
ncryption &
Authentication

• Vulnerability Assessment

A number of colleges and training companies have
aligned their cyber security curricula to NCWF.
Learning Tree, for example, has taken particular care to
establish learning paths and certifications that map to the
work roles and needed KSAs of NCWF. The overall benefit is
that learning journeys are readily available to fill the skill gaps
of an organization’s cyber security workforce.
For more information, visit LearningTree.com/Cyber

Similar to NCWF, but focusing on IT roles, is SFIA (Skills
Framework for the Information Age). Established by the
non-profit SFIA Foundation in 2000, this industry initiative
has become the gold standard for IT frameworks. Regularly
updated, SFIA 6 is the current version.

In the United Kingdom where it was first introduced,
approximately 73% of companies and government agencies
are using SFIA. In North America, adoption has been
continually accelerating. Both IEEE (Institute of Electrical
and Electronic Engineers) and CIPS (Canadian Information
Processing Society) recommend SFIA as the definitive IT
workforce framework.

Like NCWF, SFIA identifies the KSAs for various work roles
(which they call skills) — 97 in total. However, unlike NCWF,
these are further subdivided into seven levels defined by
such aspects as responsibility, authority, and autonomy.
Although counter intuitive, this recognizes that higher levels
usually require less, not more, technically-oriented skills. The
net result is 679 professional skill profiles that can be applied
to every IT job.

The SFIA Foundation is a not-for-profit organisation whose members are: BCS, The IET, IMIS, The Tech Partnership and itSMF UK.
SFIA® is a registered trademark of the SFIA Foundation.

Learning Tree has mapped all of its IT courses to the SFIA
skills and levels for both North America and Europe.
In addition, Learning Tree can provide accredited
consultants and trainers for SFIA as part of Workforce
Optimization Solutions.

Although this seems complex at first glance, it is nicely
categorized and hence easily understood. There is great
flexibility in the skills defined. It provides complete definition
of the skills needed in any IT department.

Optimizing IT Workforce Performance

Competency Modeling Using Industry-Standard Frameworks

5

1-800-843-8733 • LearningTree.com

LEARNING TREE INTERNATIONAL

White Paper

Other Industry-Standard Frameworks

ISF Adoption Process Overview

ISFs are appearing on a regular basis. For example, the
Project Management Institute (PMI)®, traditionally known for
their PMBOK® (Project Management Body of Knowledge),
has been moving to a more complete Project Management
Skills Framework in the form of the evolving Talent Triangle.

Most ISFs are free for non-commercial use. Their
implementation will assist in the alignment between
individual roles and processes that may have already been
implemented (e.g. ITIL®, Agile/Scrum, or COBIT®), thereby
helping individuals develop the skills required for their
existing or new roles. By implementing one or more ISFs
and integrating them into career pathways, organizations
indicate to their staff which skills are valued most, how
these skills can be used to progress their careers, the type
of development the organization will support, and where an
individual could use their skills within the organization.

There are similar initiatives for Agile/Scrum,
business analysis, and many more.

ISFs at their core are designed to enable organizations to
answer the key question “What skills do we need?”
As this question is answered, it becomes immediately
obvious that “What skills do we have?” must also be
posed. To maximize the benefit of adopting an ISF, both of
these questions must be answered — i.e., once the needed
skills have been identified, the organization will want to
ensure they are available so projects can be successful.

”

While technical skills are core to project and program management, PMI research tells us they’re
not enough in today’s increasingly complex and competitive global marketplace. Companies are
seeking added skills in leadership and business intelligence — competencies that can support
longer-range strategic objectives that contribute to the bottom line.
— PMI.com

Optimizing IT Workforce Performance

Competency Modeling Using Industry-Standard Frameworks

6

1-800-843-8733 • LearningTree.com

LEARNING TREE INTERNATIONAL

White Paper

ISF Adoption Process and Timelines
The high-level Gantt chart here provides an overview of the
tasks and timelines for a full ISF adoption program. Overall
duration will vary with size of the project.
The chart addresses:
• PURPLE: Development of the organizational
competency model
• GREEN: Production of optimized individual
training plans
•B
LUE: Online services applicable to both the
competency model and the training plans
•O
RANGE: Accredited training on the framework
being used
Note that the methodology shown would be typical for
almost any ISF within any organization, regardless of
being done independently or with the help of experienced,
accredited consultants. The timeline will vary with the
number of jobs in the competency model.

1. Build Operating Model

• Prerequisites: Project commencement

The Operating Model is a key and necessary
step in ISF adoption. It establishes a project
vision that aligns with the organizational
goals. An effective operating model will highlight the
rationale for including or excluding certain tasks, activities,
and training. It can also blend with in-house KSAs or skills
from more than one framework.

2. E
stablish Workforce
Communications
An absolute critical success factor for
any ISF initiative is the ability for individuals
to understand what the frameworks are, and what it means
to them. It is important to recognize the sensitivities that
individuals usually experience when going through
business transformation.
A clearly defined communications package that alleviates
fears and motivates participation will maximize the potential
for adoption success.

Optimizing IT Workforce Performance

A description of each of the numbered steps in the
Gantt chart follows:

A best practice is for the organization’s senior management
to execute the communications plan typically in a town hall
or smaller group meetings, reinforced by email and
online videos.
• Prerequisites: Completion of the operating model
• Deliverables: Communications package and delivery
to participants
• Workshop: No
• Resources: Stakeholder and manager involvement
(2 or 3 days)

Competency Modeling Using Industry-Standard Frameworks

7

1-800-843-8733 • LearningTree.com

LEARNING TREE INTERNATIONAL

White Paper

3. Assessment Configuration

• Prerequisites: Workforce communications pack started

This is an administrative step to capture
and enter into the online systems the
names and related information about the
program participants.

This task involves participants completing a
convenient online survey designed to capture
a cross spectrum of each team member’s
individual skills and level of competence, both actively being
used and latent. It also probes the skills overall within the
participants’ team to gain peripheral perspective.
Carefully worded, the survey is done using “self-appraisal”
— what the individual believes of themselves and of their
teams, not to be confused with the oft misused term,
“self-assessment”.

6. Validation Interviews
Validation interviews are intended to
confirm in one dimension, claims made by
the participants during the self-appraisal.
Interviews are performed one-on-one between a certified
consultant (or trained internal practitioner) and the
individual participants.
These interviews use proven techniques designed to
examine the veracity of the skills participants identified
during self-appraisal.

This task is labor intensive and is usually not performed if
objective knowledge validation (task 7) is utilized.
• Prerequisites: Baseline self-appraisal completed
• Deliverables: Validated individual skills profile report
• Workshop: No – individual interviews
• Resources: Approximately 1 hour per participant —
6 participants per day per interviewer
• Additional: For large numbers, not all participants need
be interviewed; a statistical sample can be used to
establish the veracity of the baseline self-appraisals

Competency Modeling Using Industry-Standard Frameworks

8

1-800-843-8733 • LearningTree.com

LEARNING TREE INTERNATIONAL

7. Objective Knowledge Validation
(Online Assessments)
Objective knowledge validation skill gap
analysis identifies the differential between
the knowledge and skills housed within the workforce of
the organization and the skills needed for projects and
services to fulfill the mission of the organization. Effective
knowledge validation skills analysis makes it possible for an
organization to direct resources to meet the requirements
of their initiatives, including improving performance, quality,
productivity, and “time to benefit.”
The process in identifying the gaps also involves
cause-determination with the goal of minimizing
reappearance of gaps in the future.
The baseline self-appraisal surveys will have identified
the workforce skills that require validation. From this,

8. Organizational Design
The organizational design task extends and
perfects the operating model produced during
task 1 by mapping and otherwise including
the discovered IT workforce current and desired states.
Accredited advisors (or internal practitioners) work with HR
and key managers to design and rationalize the organization’s
skills matrix. The key outcome is to establish a role-oriented
structure that is aligned with the organization’s goals and

This activity includes the analysis and
generation of an initial role profile baseline.
The role profile baseline is validated by interviews with
stakeholders, managers, and team leads. The Validated
Role Profile Report is one of the most important documents
delivered during the adoption of an ISF — it is the
pivotal artifact.

10. Position Matching

• Workshop: Yes — 3 days
• Resources: A few hours from select stakeholders
and managers

• Prerequisites: Organizational design underway

This is an optional activity to match individual
participant skills to the needs of each team
and other organizational entities. The goal is
to reassign job chores to different individuals and optimally
align the workers to projects.

11. I ndividual Development and
Optimized Training Plans
A key goal of an ISF adoption program is to
provide a comprehensive plan that outlines
and recommends the progression for individual development
including the training necessary to match the plan. This is for
each individual and the organization overall. It also includes
personal aspirations for progression.
Based on the skill gaps identified earlier, a certified advisor
(or internal practitioner) will review the assessment reports to

determine the optimum training plan for each team member
and the organization overall. Recommendations might
include custom courses, coaching, onboarding, or other
similar learning experiences.
• Prerequisites: Organizational design underway, skill
validation completed
• Deliverables: Continual professional development plan
• Workshop: Yes — 3 days

Competency Modeling Using Industry-Standard Frameworks

10

1-800-843-8733 • LearningTree.com

LEARNING TREE INTERNATIONAL

12. Deploy Competency Model
This activity produces the final artifacts from
the adoption project — they summarize and
provide insightful guidance to the organization
as a whole, often with presentations and discussions with
key stakeholders.
Throughout the adoption project, advisors would have been
using a number of different data collection and analysis tools.
These have various automated reports that provide different

White Paper

perspectives which will be provided as determined by
the project findings.
• Prerequisites: All previous tasks completed
• Deliverables: Skills inventory and validated
organizational role matrix
• Workshop: No
• Resources: Brief meetings with some participants,
managers and stakeholders

This is the last step in an ISF adoption project.

Ongoing Continual Improvement

A Partner for Workforce Optimization

Skill-needs analysis and individual assessment programs
should not be a one-time engagement. Over a period
of time, the benefits and advances gained will wane as
technology advances and with staff turnover. Ongoing
partnership to foster continual improvement in the workforce
is recommended.

Learning Tree seeks to be a valuable partner to your
organization. Our mission is to help you achieve optimal
productivity of your workforce. We can:

Workforce Optimization Solutions
Learning Tree has been providing quality training, coaching,
and workforce enhancement services for nearly 42 years.
Our instructor corps of 600+ practitioners cover virtually any
IT discipline. They all currently work in their field of expertise
and have real-world experience in their subject areas —
experience you can leverage immediately. Recognizing
the need for more effective and convenient workforce
enhancement capabilities, Learning Tree has developed
leading-edge workforce assessment tools and processes
that enable competency reviews and assessments to be
completed in a fraction of the time it might otherwise take.
The results are verifiable, with high validity and reliability.

Optimizing IT Workforce Performance

1. Help you build a world-class workforce aligned
to your strategic objectives, and maximize
the overall potential for reach or exceed all
organizational goals.
2. H
elp you invest your workforce development budget
in a smarter way to address skill gaps.
3. H
elp identify and apply the right skills enhancement
solutions at the right time.
4. H
elp build successful project teams now and
in the future.
Learning Tree has a 42-year track record of proven results in
the IT industry. More than 66,000 organizations — from the
world’s largest multinational corporations and government
agencies — have turned to us as a trusted partner.
Learning Tree is committed to your organization’s success
and will strive to exceed expectations in all of the services
we provide.

Competency Modeling Using Industry-Standard Frameworks

11

1-800-843-8733 • LearningTree.com

LEARNING TREE INTERNATIONAL

About Learning Tree International

About the Author

Established in 1974, Learning Tree is a leading provider
of IT training to business and government organizations
worldwide. Learning Tree provides Workforce Optimization
Solutions — a modern approach to delivering learning
and development services that improves the adoption of
skills, and accelerates the implementation of technical and
business processes required to improve IT service delivery.
These services include: needs assessments, skill gaps
analyses, blended learning solutions, and
acceleration workshops.
Over 2.5 million professionals have enhanced their skills
through Learning Tree’s extensive course library including:
web development, cyber security, program and project
management, Agile, operating systems, networking,
cloud computing, leadership, and more.
To learn more, call 1-800-THE-TREE (843-8733)
or visit LearningTree.com
Connect with us online:

White Paper

Gregory L. Adams, P. Eng.
Senior Consultant,
President & CEO of ISDI,
Learning Tree Instructor & Author
Gregory has been in the IT field for more than 35 years,
with extensive experience both in the government and
private industries. His areas of expertise include software
engineering, advanced design, Agile/Scrum transformation,
SFIA/NCWF adoption, and web and mobile device security.
• Has undertaken numerous projects, including those in
approximately 50 of the FORTUNE 500 companies.
• President and CEO of ISDI — a consulting company
dedicated to excellence in software design
and development.
• Previously served as Learning Tree
Chief Strategy Officer.
Acknowledgements
Matthew Burrows, primary SFIA architect for his
industry-changing insights and contributions to the
development of SFIA and its adoption process.

Optimizing IT Workforce Performance

Competency Modeling Using Industry-Standard Frameworks

12

COBIT® is a registered trademark of Information Systems Audit and Control Association® (ISACA®). ITIL® is a registered trade mark of AXELOS Limited,
used under permission of AXELOS Limited. All rights reserved. PMI and PMBOK are marks of the Project Management Institute, Inc.
US1702 WORKFORCEWP